CSRF django nginx与来自cloudflare的ssl

背景

我正在尝试配置我的Django应用程序以使用cloudflare提供的ssl.我有与this answer相同的设置,并遵循相同的解决方案.

问题：

这已经杀了我几个星期了(请帮忙！)因为我不是一个网络/安全人员,只需要一个解决方案,这将避免我盯着我看,但保持网站安全.

我目前正在收到CSRF问题,其中https://www.domain.co.uk与https://domain.co.uk不匹配

配置

Settings.py

SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTOCOL', 'https')
MIDDLEWARE_CLASSES = (
'django.contrib.sessions.middleware.SessionMiddleware',
'django.middleware.common.CommonMiddleware',
'django.middleware.csrf.CsrfViewMiddleware',
'django.contrib.auth.middleware.AuthenticationMiddleware',
'django.contrib.auth.middleware.SessionAuthenticationMiddleware',
'django.contrib.messages.middleware.MessageMiddleware',
'django.middleware.clickjacking.XFrameOptionsMiddleware',
)
USE_X_FORWARDED_HOST = True

Nginx的：

server {

    listen 80 default_server;

    server_name domain.co.uk www.domain.co.uk;
    access_log off;

    location /static/ {
        alias /static/;
    }


    location / {
            proxy_pass http://127.0.0.1:8000;
            proxy_set_header X-Forwarded-Host $server_name;
            proxy_set_header X-Real-IP $remote_addr;
            add_header P3P 'CP="ALL DSP COR PSAa PSDa OUR nor ONL UNI COM NAV"';

            proxy_set_header X-Scheme $scheme;
            proxy_set_header X-Forwarded-Protocol $scheme;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $http_host;
            }
}

Cloudflare DNS：

A domain.co.uk  points to <ip> Automatic
CNAME www is an alias of domain.co.uk Automatic 

奖金

此外,我还有域名的.com,并想知道如何最好地设置它,以便它也是ssl.

解决方法:

您需要设置发送CSRF cookie的域.尝试在您的设置中将CSRF_COOKIE_DOMAIN设置为“.domain.co.uk”并将CSRF_COOKIE_SECURE设置为True.

点#4值得阅读https://docs.djangoproject.com/en/1.9/ref/csrf/#how-it-works